SY0-701 Practice Exam 62 — 20 Questions

Question 1

EDR alerts on a remote laptop show a suspicious process attempting to dump browser credentials and then contacting a rare domain. The user is in another time zone and still needs the laptop online for a presentation later today. What containment action is best?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Remotely isolate the device through the EDR console while keeping it powered on.. Remotely isolating the device through the EDR console is the best containment action because it immediately blocks all network communication to and from the laptop while keeping it powered on and running. This prevents the suspicious process from exfiltrating browser credentials or communicating with the rare command-and-control domain, yet allows the user to continue using local applications for the presentation later today. EDR isolation typically works by applying a host-based firewall rule that drops all traffic except to the EDR management server, ensuring the threat is contained without disrupting local productivity.

Answer

Ask the user to uninstall the EDR agent and reboot the laptop.

Answer

Wait until after the presentation and then begin containment.

Answer

Email the user asking them to close the browser and log out of their accounts.

Question 2

A company wants employees to use their normal login from managed devices but require extra verification when they sign in from an unmanaged laptop or a new location. Which two controls should the team use? Select two.

Accepted Answer

Conditional access. Conditional access (A) is correct because it allows the company to define policies that grant or block access based on conditions such as device compliance (managed vs. unmanaged) and location (trusted vs. new). Multi-factor authentication (B) is correct because it provides the extra verification step required when the conditional access policy detects an unmanaged laptop or a new location, ensuring the user proves their identity beyond just a password.

Answer

DNS filtering

Answer

Disk encryption

Answer

Port security

Question 3

An operations manager states that the customer portal may be unavailable for no more than 15 minutes in a month before the issue must be escalated to executives. Which risk management concept does this statement describe?

Accepted Answer

Risk tolerance, because it sets a specific measurable threshold for acceptable impact.. Risk tolerance defines the specific, measurable deviation from risk appetite that an organization is willing to accept. The operations manager's statement sets a precise threshold—15 minutes of unavailability per month—before escalation is required, which is a classic example of risk tolerance in IT service management.

Answer

Risk appetite, because it describes the organization’s overall willingness to take risk.

Answer

Risk transfer, because the business is moving the outage risk to another party.

Answer

Risk avoidance, because the organization is eliminating the portal risk completely.

Question 4

A security team wants to know whether a workstation has drifted away from the approved hardened configuration after several months of changes. What should they use to compare the current state against the approved setup?

Accepted Answer

A configuration baseline. A configuration baseline is the approved hardened state of a system, typically captured as a snapshot of settings, registry keys, file permissions, and installed software. By comparing the current workstation state against this baseline using tools like Microsoft Security Compliance Toolkit or CIS-CAT, the team can detect drift—unauthorized changes that deviate from the secure configuration. This is the standard method for maintaining compliance and security posture over time.

Answer

A file compression tool

Answer

A password vault

Answer

A network cable tester

Question 5

An investigator must collect data from a suspected insider-threat laptop so the evidence could be used in an HR and legal review. Which action best preserves admissibility?

Accepted Answer

Create a forensic image through a write blocker and record hashes before and after acquisition. Creating a forensic image through a write blocker ensures the original evidence is not altered, preserving its integrity for admissibility in HR and legal proceedings. Recording hashes before and after acquisition allows verification that the image is an exact, unmodified copy, which is critical for chain of custody and meeting legal standards such as Daubert or Federal Rules of Evidence.

Answer

Boot the laptop normally and browse the user's files for clues

Answer

Copy the user's documents to a USB drive and continue the investigation later

Answer

Take screenshots of the desktop and delete the original drive contents afterward

Question 6

A manager asks how to decide whether a new security issue is worth spending money on. Which two factors should be reviewed first? Select two.

Accepted Answer

Likelihood that the issue will be exploited. The likelihood of exploitation is a fundamental factor in risk assessment. Without understanding how probable it is that a threat actor will exploit a vulnerability, an organization cannot prioritize remediation efforts effectively. This is a core component of risk calculation (Risk = Likelihood × Impact).

Answer

The color used on the vulnerability report

Answer

The number of users in the IT department

Answer

The age of the server name in inventory

Question 7

A finance analyst receives an email that appears to come from the CFO. It references a real project, asks for an urgent wire transfer to a "new vendor account," and says to avoid the normal approval workflow because the deal is time-sensitive. What is the best immediate response?

Accepted Answer

Verify the request using a known-good contact method and report the message as suspicious.. The best immediate response is to verify the request using a known-good contact method (e.g., a phone number from the corporate directory) and report the message as suspicious. This defeats the impersonation attempt because the attacker cannot control the out-of-band channel. It also follows the principle of verifying unusual or urgent financial requests through a separate trusted path.

Answer

Reply to the email asking for additional payment details and wait for a response.

Answer

Process the transfer quickly because the message appears to come from an executive.

Answer

Forward the email to another finance employee so someone else can confirm the request.

Question 8

A supplier portal is browser-based and used by external partner companies. Each partner already has its own identity provider. The portal must trust assertions from those IdPs and avoid creating separate local passwords for each partner. Which integration is best?

Accepted Answer

Use SAML 2.0 federation with trust relationships to the partner identity providers.. SAML 2.0 federation is the correct choice because it enables the supplier portal to trust assertions from multiple external identity providers (IdPs) without creating local passwords. SAML uses XML-based tokens signed by the partner's IdP, allowing the portal to accept authentication claims via a trust relationship, which directly meets the requirement of avoiding separate local credentials for each partner.

Answer

Use LDAP directory synchronization for all partner users.

Answer

Use NTLM pass-through authentication to each partner account.

Answer

Use PAP over TLS so the portal can collect partner passwords securely.

Question 9

A security analyst receives an alert that a user's workstation is communicating with a known malicious IP address during off-hours. The analyst reviews the firewall logs and confirms the connection was established. Which of the following should the analyst perform NEXT to contain the threat?

Accepted Answer

Isolate the workstation from the network.. Isolating the workstation from the network (Option B) is the immediate containment step because it stops the active communication with the known malicious IP address, preventing further data exfiltration, lateral movement, or command-and-control (C2) activity. This aligns with the NIST incident response framework's containment phase, which prioritizes stopping the threat before investigation or remediation. Disabling the user account (A) does not stop the network-level communication if the malware is running as a service or using cached credentials, and running a scan (C) or notifying management (D) are post-containment actions.

Answer

Disable the user's account immediately.

Answer

Run a full antivirus scan on the workstation.

Answer

Notify the user's manager of the policy violation.

Question 10

Based on the exhibit, what is the most likely explanation for the alert?

Accepted Answer

The workstation has been redirected to an approved corporate proxy, so the event is expected.. The alert indicates that the workstation's DNS traffic is being redirected to an internal proxy server (10.0.0.53), which is a common configuration in corporate environments for content filtering and security monitoring. Since the destination IP (10.0.0.53) is within the organization's private IP range and the proxy is explicitly approved, this behavior is expected and not malicious. The event is consistent with a transparent proxy or DNS-based proxy redirection, where the workstation's DNS queries are intercepted and forwarded to the corporate proxy.

Answer

A DNS cache poisoning attack is in progress and the workstation is now using a rogue gateway.

Answer

The endpoint is infected with malware that is hiding its traffic through encrypted tunnels.

Answer

The workstation is under a denial-of-service attack because it sent repeated DNS lookups.

Question 11

After several rounds of phishing simulations, management wants a metric that best shows employees are improving at recognizing suspicious messages. Which metric should security track?

Accepted Answer

The percentage of users who report simulated phishing emails to security.. The percentage of users who report simulated phishing emails to security directly measures behavioral change, showing that employees are actively recognizing and acting on suspicious messages. This metric reflects the effectiveness of security awareness training by tracking the desired response—reporting—rather than passive metrics like email volume or ticket counts.

Answer

The number of training emails sent to employees each month.

Answer

The number of spam emails blocked by the mail gateway.

Answer

The number of help desk tickets closed within the month.

Question 12

A file-conversion API accepts a URL to generate a preview image. An attacker submits a URL for the cloud metadata service at 169.254.169.254 and receives instance credentials in the preview output. What attack is this?

Accepted Answer

Server-side request forgery. The attack is Server-Side Request Forgery (SSRF) because the attacker manipulates the file-conversion API into making an outbound HTTP request to an internal IP address (169.254.169.254, the cloud metadata service). The API then returns the metadata (including instance credentials) in the generated preview image, exploiting the server's trust to access internal resources that are not directly accessible from the internet.

Answer

SQL injection

Answer

Cross-site request forgery

Answer

Command injection

Question 13

A company's current remote access solution uses a traditional VPN that grants users full network-layer access to the internal LAN once authenticated. The security architect wants to adopt a zero trust architecture to reduce the risk of lateral movement by compromised endpoints. Which of the following implementations best aligns with zero trust principles?

Accepted Answer

Use a software-defined perimeter that authenticates each user and device before granting access only to specific applications.. A software-defined perimeter (SDP) implements zero trust by authenticating both the user and device before granting access to specific applications, not the entire network. This prevents lateral movement by ensuring that even after authentication, the endpoint can only reach the allowed application, not the full LAN. This aligns with the zero trust principle of 'never trust, always verify' and micro-segmentation.

Answer

Implement a next-generation firewall and require all remote traffic to pass through it with strict rules.

Answer

Deploy a secure web gateway and require all remote users to browse through a proxy.

Answer

Enable multi-factor authentication for VPN and implement a VPN concentrator with split tunneling.

Question 14

A customer portal must stay online if an entire site fails, and the company must also be able to recover if data is corrupted or encrypted by ransomware. Which two design choices best satisfy both requirements? Select two.

Accepted Answer

Use active-active or automatic failover between two sites with health checks.. Active-active or automatic failover between two sites with health checks ensures that if an entire site fails, traffic is automatically redirected to the surviving site, maintaining availability. This design satisfies the first requirement of staying online during a site failure by using redundant infrastructure and health monitoring to detect and react to outages.

Answer

Keep only RAID 1 inside each server, because mirroring alone handles site outages.

Answer

Store nightly backups on the same storage array as the production data.

Answer

Replace the load balancer with a static DNS record for each server.

Question 15

Match each change-management practice to the best description for reducing patching risk in production.

Accepted Answer

Change Advisory Board: A group that reviews and approves changes to reduce unauthorized modifications.. These change-management practices reduce patching risk by ensuring proper review, scheduling, rollback capability, pre-testing, documentation, and automation to minimize errors.

Answer

Change Advisory Board: Testing patches in a staging environment before deployment.

Answer

Rollback plan: Performing patching during a time window that minimizes impact on operations.

Question 16

A finance application records each approval with the manager's unique user ID and a digital signature. Auditors want proof that the manager cannot later deny approving the transaction. Which security objective is most directly being addressed?

Accepted Answer

Nonrepudiation. Nonrepudiation ensures that a party cannot deny having performed a specific action. By recording the manager's unique user ID and a digital signature, the system provides cryptographic proof that the manager approved the transaction, making it impossible for them to later deny it. This directly addresses the audit requirement for undeniable evidence of approval.

Answer

Availability

Answer

Confidentiality

Answer

Accountability

Question 17

Several employees report receiving SMS messages that appear to come from the corporate service desk. The text says, 'Your password expires today. Review the notice here,' followed by a shortened link that opens a fake sign-in page on a phone browser. Which type of attack is this?

Accepted Answer

Smishing. This is smishing because the attack uses SMS messages to deliver a phishing link that directs recipients to a fake sign-in page, attempting to steal their credentials. Smishing is a form of social engineering that exploits the trust in text messaging and the urgency of a password expiration notice to bypass email security filters.

Answer

Pretexting

Answer

Tailgating

Answer

Spoofing

Question 18

A firewall rule must be changed to allow a vendor update server. Which step best reduces the chance of an unexpected outage?

Accepted Answer

Document the change, get approval, and include a rollback plan.. Following a formal change management process—documenting the change, obtaining approval, and including a rollback plan—ensures that the firewall rule modification is reviewed for potential impacts, authorized by stakeholders, and can be reverted if it causes an outage. This structured approach minimizes the risk of unexpected downtime by validating the change in a controlled manner and providing a safety net.

Answer

Make the change directly in production without review to save time.

Answer

Disable the firewall temporarily while the update is tested.

Answer

Apply the rule but do not tell anyone so there is less paperwork.

Question 19

EDR flags encoded PowerShell launched by a spreadsheet application and an outbound HTTPS connection to a rare domain. Which two response actions are best to take from the EDR console first? Select two.

Accepted Answer

Isolate the endpoint from the network through the EDR platform. Isolating the endpoint from the network (A) is correct because it immediately stops the outbound HTTPS connection to the rare domain, preventing potential command-and-control (C2) data exfiltration or further payload download. Collecting a triage package or memory snapshot (B) is correct because the encoded PowerShell script and suspicious process chain are volatile artifacts that may be lost on reboot or remediation, and capturing them preserves forensic evidence for analysis.

Answer

Uninstall the spreadsheet application immediately

Answer

Reboot the endpoint to clear the suspicious script

Answer

Wait for a second alert before taking any action

Question 20

A user forwards an email that says a shared document is available and must be reviewed within 10 minutes. The display name looks like a trusted vendor, but the Reply-To address points to a free webmail account. Which two details are strongest indicators that this is a phishing attempt? Select two.

Accepted Answer

The message creates a short deadline and pressures the user to act quickly.. Phishing attacks frequently use urgency and time pressure to bypass the victim's rational analysis, exploiting the psychological principle of scarcity to trigger impulsive clicks. The 10-minute deadline is a classic social engineering tactic to prevent the user from verifying the email's legitimacy through normal channels.

Answer

The message includes the company's logo and professional-looking formatting.

Answer

The email refers to a shared document that the user should review.

Answer

The message was received during normal business hours.